Identity Manager container: TRUSTEDSOURCEKEY environment variable usage and common errors (4384167)

When deploying Identity Manager web or API containers (Docker/Kubernetes), setting the TRUSTEDSOURCEKEY environment variable may fail with:

sed: -e expression #1, char 26: unknown option to 's'

Or the value in QBMWebApplication.TrustedSourceKey does not update after setting a custom key.

Two common mistakes:

#1 Using the hashed value from the database (format P|E|hash1|hash2) as the environment variable. 

The pipe characters break the container's sed-based substitution script which uses | as its delimiter.

#2 Setting TRUSTEDSOURCEKEY without FORCETRUSTEDSOURCEKEY=true when a TrustedSourceKey already exists in the database.

Without this flag, the container only writes the hash if no key is set yet.

To set a custom TrustedSourceKey that you control:

1. Choose a plain-text key using alphanumeric characters only (avoid |, /, \, &, #)

2. On the first container run, set both environment variables:

• TRUSTEDSOURCEKEY=<your-plain-text-key>
• FORCETRUSTEDSOURCEKEY=true

3. The container will write the key to web.config and store the corresponding hash in QBMWebApplication.TrustedSourceKey

4. On subsequent runs, keep TRUSTEDSOURCEKEY set but remove FORCETRUSTEDSOURCEKEY

Alternatively, use GENERATETRUSTEDSOURCEKEY=true on first run to auto-generate a key. Note: this implies FORCETRUSTEDSOURCEKEY and always overwrites the existing value. The generated plain-text key is not retrievable afterwards.

Verify at login time by checking the application log for:

User login comes from a trusted source. Accept WHERE clauses.